Graylog2 / Graylog2/graylog2-server
DNS PTR Lookup - Dot after value inconstant behavior
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
When I do a Test lookup in the Lookup Tables "Data Adapters" Page with an IP as key I want to get the FQDN from the server as single value. It should be the same value I would get out from the "Force rDNS" option of an syslog input.
## Current Behavior
When I do the Test lookup for an IP I get:
```
{
"single_value": "server.domain.com.",
"multi_value": {
"domain": "domain.com",
"full_domain": "server.domain.com.",
"dns_ttl": 3600
},
"ttl": 3600000
}
```
As you can see after single_value I get an additionally dot at the end. Also, by the full_domain, but not by the domain itself. This dot at the end, isn't really wrong, but not what you expect when you do a reverse lookup. I want to get "server.domain.com" as result.
## Context
I have a Raw/Plaintext Input (because of Cisco), so I can't make "Force rDNS?".
So, I built my own Reverse DNS with a Lookup Table Adapter Type "DNS Lookup", DNS Lookup Type "Reverse lookup (PTR)"
Main problem is the inconstant behavior, when I got logs from nxlog the source is a FQDN without dot, when I do an "Force rDNS" in an syslog input the source is a FQDN without dot, but when I do the reverse lookup with an lookup table I got a dot at the end.
But for an search "source:server.domain.com" and "source:server.domain.com." is not the same.
## Possible Solution
Remove the dot at the end when you do a Lookup table PTR lookup.
## Workaround
I remove the dot with an extractor, but a constant behavior would be better.
## Your Environment
* Graylog Version: Graylog 3.1.0 (Oracle Corporation 1.8.0_222 on Linux 4.9.0-9-amd64)
* Elasticsearch Version: 6.8.2
* MongoDB Version: 4.0.12
* Operating System: Debian 9
Contributor guide
Assessment
This issue has not been assessed yet.